From 3a5813b32f917c7668d663fd5cb7538251a23301 Mon Sep 17 00:00:00 2001 From: Tor Andersson Date: Fri, 12 Nov 2010 12:58:22 +0000 Subject: Detect flate/runlength decompression bombs. --- fitz/stm_read.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'fitz') diff --git a/fitz/stm_read.c b/fitz/stm_read.c index 28a92f22..94b6d709 100644 --- a/fitz/stm_read.c +++ b/fitz/stm_read.c @@ -70,6 +70,9 @@ fz_readall(fz_buffer **bufp, fz_stream *stm, int initial) if (buf->len == buf->cap) fz_growbuffer(buf); + if (buf->len > initial * 100) + return fz_throw("compression bomb detected"); + n = fz_read(stm, buf->data + buf->len, buf->cap - buf->len); if (n < 0) { -- cgit v1.2.3